Attack traffic never reaches your server

Where the filtering happens

Protection that runs on your own server is not protection. By the time a flood reaches the machine it has already crossed your uplink, and a saturated uplink drops legitimate traffic just as effectively as a saturated CPU does.

Virtbase servers sit behind aurologic GmbH's filtering, which is upstream of the network the machine is on. Attack traffic is scrubbed before it arrives, so your uplink never carries it and your server never sees it.

That also means there is nothing for you to run, tune or keep patched. There is no agent on the machine, no rule to write, and no threshold to guess.

DDoS protection is not a firewall

These get conflated constantly, and the difference matters when something goes wrong.

DDoS filtering is automatic, upstream and about volume and shape. It has no opinion about which of your ports should be open — it removes traffic that is attacking you and passes the rest.

The firewall is yours, it runs at your server's edge, and it is about policy. It is what closes the SSH port to everyone except your office, or leaves 25565 open only to the people who should reach your game server.

An attack that saturates a link is a job for the first. A port that should never have been open is a job for the second. Running one does not remove the need for the other, which is why both are included rather than sold as tiers.

What you should still do

Filtering is not an excuse to leave the machine open. Close the ports you do not use with firewall rules, keep services patched, and take a backup before you change anything that matters.

Attacks that succeed against a protected server almost never succeed by volume. They succeed because something was listening that should not have been.